Found an XSS bypass during a bug bounty

Found an XSS bypass during a bug bounty:
Backend was only stripping quotes ("), so payload like:
<s"vg o"nload=al"ert() />
turns into a valid:
<svg onload=alert()>
Never Rely on Poor Input Filtering !